Critical severity9.1NVD Advisory· Published Jun 24, 2022· Updated Jun 17, 2026
CVE-2022-30117
CVE-2022-30117
Description
Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete doesn’t allow traversal and by changing isFullChunkFilePresent to have an early false return when input doesn't match expectations.Concrete CMS Security team ranked this 5.8 with CVSS v3.1 vector AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H. Credit to Siebene for reporting.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
concrete5/corePackagist | >= 9.0.0, < 9.1.0 | 9.1.0 |
concrete5/corePackagist | < 8.5.8 | 8.5.8 |
Affected products
3- Concrete CMS/Concrete CMSdescription
Patches
Vulnerability mechanics
References
5- documentation.concretecms.org/developers/introduction/version-history/858-release-notesnvdRelease NotesVendor AdvisoryWEB
- documentation.concretecms.org/developers/introduction/version-history/910-release-notesnvdRelease NotesVendor AdvisoryWEB
- github.com/advisories/GHSA-3jxh-6635-6jwpghsaADVISORY
- hackerone.com/reports/1482280nvdPermissions RequiredThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2022-30117ghsaADVISORY
News mentions
0No linked articles in our index yet.